hecks 3.10.0 → 3.12.0

data/lib/hecks/runtime/policy_interpreter.rb

@@ -20,11 +20,11 @@ module Hecks
 
       # @param registry [Runtime::Registry] the booted registry whose loaded
       #   bluebooks are scanned for candidate policies
-      # @param door [Runtime::Dispatcher] the dispatcher reactions re-enter through,
+      # @param dispatcher [Runtime::Dispatcher] the dispatcher reactions re-enter through,
       #   and whose reaction-depth guard is checked before each delivery
-      def initialize(registry, door:)
+      def initialize(registry, dispatcher:)
         @registry = registry
-        @door     = door
+        @dispatcher = dispatcher
       end
 
       # Fires every declared policy `event` triggers, recording each outcome on
@@ -96,15 +96,15 @@ module Hecks
       # may go.
       def fire(policy, event, target, record)
         return nil unless where_holds?(policy, event)
-        return depth_refusal(record) if @door.reaction_depth_reached?
+        return depth_refusal(record) if @dispatcher.reaction_depth_reached?
 
         args = trigger_args(policy, event)
-        @door.reenter(target, **reaction_invocation(target, args, policy, event))
+        @dispatcher.reenter(target, **reaction_invocation(target, args, policy, event))
         record.merge(delivered: true)
       end
 
       def depth_refusal(record)
-        record.merge(delivered: false, reason: "reaction depth #{@door.max_reaction_depth} reached")
+        record.merge(delivered: false, reason: "reaction depth #{@dispatcher.max_reaction_depth} reached")
       end
 
       # A defect, not a refusal: recorded with `defect: true` and warned, never

data/lib/hecks/runtime/port_operation_interpreter.rb

@@ -157,7 +157,7 @@ module Hecks
           aggregate:   "#{ctx.domain}::#{ctx.aggregate.hecks_name}",
           id:          ctx.route.aggregate,
           payload:     payload,
-          occurred_at: Time.now.utc.iso8601
+          occurred_at: Event.stamp
         )
       end
     end

data/lib/hecks/runtime/reaction_invocation.rb

@@ -90,7 +90,7 @@ module Hecks
       # @raise [Runtime::UnknownVerb] if `verb` does not resolve (only when `explicit`)
       # @raise [Runtime::TypeMismatch] if no receiver identity resolves for an explicit target
       # @raise [Runtime::UnknownArgument] if an explicit projection has an undeclared fact
-      # rubocop:disable-next Metrics/ParameterLists -- the keyword door both interpreters call
+      # rubocop:disable-next Metrics/ParameterLists -- the keyword entry point both interpreters call
       def build(registry:, verb:, projected:, explicit:, passthrough: [], source_receiver: nil)
         args = projected.transform_keys(&:to_sym)
         return forwarded(registry, verb, args, source_receiver) unless explicit

data/lib/hecks/runtime/rebuild_sweep.rb

@@ -49,7 +49,17 @@ module Hecks
         return nil if id.nil?
 
         remote = registry.repository(domain, target).find(id.to_s)
-        remote&.[](field.remote_field)
+        unwrap_single_field(target, field, remote&.[](field.remote_field))
+      end
+
+      # A remote field typed by a single-field value object is copied as its one scalar, so the
+      # projecting aggregate holds `123`, never `{ value: 123 }`. Any other value is copied as is.
+      def unwrap_single_field(target, field, value)
+        attribute = target.attribute(field.remote_field)
+        sole = attribute && target.value_object(attribute.type)&.sole_attribute
+        return value unless sole && !value.nil?
+
+        value.is_a?(Hash) ? value.fetch(sole.name) { value[sole.name.to_s] } : value[sole.name]
       end
     end
   end

data/lib/hecks/runtime/registry/ask_verification.rb

@@ -0,0 +1,35 @@
+require_relative "../../bluebook/ask_resolution"
+
+module Hecks
+  module Runtime
+    class Registry
+      # The boot gate for `ask`: every policy's ask must resolve to one declared port operation,
+      # so a name the hecksagon never declared stops the boot instead of firing at nothing.
+      # Mixed into {Verification}.
+      module AskVerification
+        private
+
+        # A port operation a chapter provides, and an ask a policy makes, each name a port
+        # operation the hecksagon declared.
+        def refuse_unresolved_ports!
+          refuse_unresolved_port_operations!
+          refuse_unresolved_asks!
+        end
+
+        # Binds each ask to the operation it resolves to, refusing the first that resolves to none.
+        #
+        # @raise [WiringError] naming the policy, the ask and what the hecksagon would need
+        def refuse_unresolved_asks!
+          @declared.bluebooks.each_value do |chapter|
+            chapter.policies.select(&:asks?).each do |policy|
+              outcome = Bluebook::AskResolution.call(chapter, policy)
+              raise WiringError, outcome.detail unless outcome.resolved?
+
+              policy.resolve_ask!(outcome.verb)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hecks/runtime/registry/hecksagon_rules.rb

@@ -27,6 +27,16 @@ module Hecks
                 "without that it is silent decoration, the exact defect this refusal exists to catch"
         end
 
+        # `driven_by` names a driving adapter; a name none answers to would silently admit nothing.
+        def refuse_unknown_driving!(hecksagon)
+          unknown = hecksagon.driving - Bluebook::Hecksagon::DRIVING_ADAPTERS
+          return if unknown.empty?
+
+          raise WiringError,
+                "#{hecksagon.domain} is driven_by #{unknown.map(&:inspect).join(", ")}, which no driving " \
+                "adapter answers to — the adapters are #{Bluebook::Hecksagon::DRIVING_ADAPTERS.join(", ")}"
+        end
+
         # `attaches` loads a bounded context; the consumer must declare the sibling hecksagon
         # that is its ACL (Governance/Identity/Privacy already do). A vendored package only
         # loads its `.bluebook` files, so persistence, Governance and the `translates` ACL live

data/lib/hecks/runtime/registry/merging.rb

@@ -17,7 +17,7 @@ module Hecks
         def merge_hecksagons(base, overlay)
           # Order-independent: list facts uniq, so loading context_map before or after the
           # domain file yields the same merged hecksagon.
-          lists = %i[subscriptions attachments translates].to_h do |facet|
+          lists = %i[subscriptions attachments translates driving].to_h do |facet|
             [facet, (base.public_send(facet) + overlay.public_send(facet)).uniq]
           end
           Bluebook::Hecksagon.new(domain: base.domain, binds: base.binds + overlay.binds,

data/lib/hecks/runtime/registry/providers.rb

@@ -101,6 +101,16 @@ module Hecks
           vendored_provider_for(domain, Bluebook::Capabilities::PAYMENT_CONNECTION)
         end
 
+        # The chapter that owns the checkout boundary for `domain` — resolved by what it
+        # declares (`provides "checkout"`). Nil when none does.
+        #
+        # @param domain [String, Symbol] the domain whose checkout chapter is being resolved
+        # @return [Bluebook::Chapter, nil] the chapter that owns `domain`'s checkout windows,
+        #   or nil if none does
+        def checkout_provider_for(domain)
+          vendored_provider_for(domain, Bluebook::Capabilities::CHECKOUT)
+        end
+
         # The chapter that takes payments for `domain`: the domain's own chapter, a
         # framework member, or a vendored embryonaut bluebook it attaches, that
         # declares `provides "payments"`.
@@ -112,6 +122,12 @@ module Hecks
           vendored_provider_for(domain, Bluebook::Capabilities::PAYMENTS)
         end
 
+        # The first loaded chapter that declares `capability`, whichever domain asks.
+        #
+        # @param capability [String] a `Bluebook::Capabilities` name
+        # @return [Bluebook::Chapter, nil] the providing chapter, or nil if none loaded does
+        def provider_of(capability) = bluebooks.values.find { |chapter| chapter.provides?(capability) }
+
         # The chapter that provides `capability` for `domain`: the domain's own chapter,
         # a framework member its hecksagon attaches, or a vendored embryonaut bluebook
         # it attaches, that declares it.

data/lib/hecks/runtime/registry/read_repository.rb

@@ -1,3 +1,5 @@
+require_relative "../best_effort"
+
 module Hecks
   module Runtime
     class Registry
@@ -37,10 +39,10 @@ module Hecks
         #   `authoritative`, in the same order; false on any mismatch, or if comparing
         #   them raises
         def projection_current?(projection, authoritative)
-          entries_match?(projection.entries, authoritative.entries) &&
-            sorted_rows(projection) == sorted_rows(authoritative)
-        rescue StandardError
-          false
+          BestEffort.call(false) do
+            entries_match?(projection.entries, authoritative.entries) &&
+              sorted_rows(projection) == sorted_rows(authoritative)
+          end
         end
 
         private

data/lib/hecks/runtime/registry/verification.rb

@@ -1,5 +1,6 @@
 require_relative "../../bluebook/hecksagon"
 require_relative "hecksagon_rules"
+require_relative "ask_verification"
 require_relative "query_verification"
 require_relative "chapter_verification"
 require_relative "durability_warnings"
@@ -11,6 +12,7 @@ module Hecks
       # port's verb, and every world default is usable. `verify!` runs it all at boot.
       module Verification
         include HecksagonRules
+        include AskVerification
         include QueryVerification
         include ChapterVerification
         include DurabilityWarnings
@@ -24,7 +26,7 @@ module Hecks
           refuse_cross_package_bluebook_merge!
           refuse_reserved_chapter_names!
           refuse_membership_without_identity!
-          refuse_unresolved_port_operations!
+          refuse_unresolved_ports!
           refuse_unanswerable_queries!
 
           @declared.hecksagons.each_value { |hecksagon| verify_hecksagon!(hecksagon) }
@@ -126,6 +128,7 @@ module Hecks
         # warnings for its chapter.
         def verify_hecksagon!(hecksagon)
           refuse_ungoverned_roles!(hecksagon)
+          refuse_unknown_driving!(hecksagon)
           refuse_unwired_attachments!(hecksagon)
           refuse_bounded_without_acl!(hecksagon)
           hecksagon.binds.each { |bind| verify_bind!(hecksagon, bind) }

data/lib/hecks/runtime/registry/world_defaults.rb

@@ -28,8 +28,37 @@ module Hecks
           self
         end
 
+        # The defaults an adapter's `.adapter` declares for its fields, with each `{name}` or
+        # `{storage_name}` in a string filled from `aggregate`. A world's own setting always wins.
+        #
+        # @param adapter [String, Symbol] the adapter's name
+        # @param aggregate [Bluebook::Aggregate] the aggregate the adapter is built for
+        # @return [Hash{Symbol => Object}] the defaults, empty when the adapter declares none
+        def adapter_defaults(adapter, aggregate)
+          declared = @declared.adapters[adapter.to_s]&.declared_defaults || {}
+          declared.transform_values { |value| fill_placeholders(value, aggregate) }
+        end
+
+        # `settings` laid over the adapter's declared defaults. A field a world gives as `:default`
+        # asks for the declared default, so it is left out and the default shows through.
+        #
+        # @param adapter [String, Symbol] the adapter's name
+        # @param aggregate [Bluebook::Aggregate] the aggregate the adapter is built for
+        # @param settings [Hash{Symbol => Object}] the settings the world gave
+        # @return [Hash{Symbol => Object}] the defaults, overridden by the settings given
+        def with_adapter_defaults(adapter, aggregate, settings)
+          adapter_defaults(adapter, aggregate).merge(settings.reject { |_, value| value == :default })
+        end
+
         private
 
+        # A string default with its placeholders filled from the aggregate; any other value as is.
+        def fill_placeholders(value, aggregate)
+          return value unless value.is_a?(String)
+
+          value.gsub(/\{(name|storage_name)\}/) { aggregate.public_send(Regexp.last_match(1)) }
+        end
+
         # The chapter's own world answers first; the project's world fills the gap.
         def world_default(domain, field)
           world(domain)&.public_send(field) || project_world&.public_send(field)

data/lib/hecks/runtime/registry.rb

@@ -45,7 +45,7 @@ module Hecks
       #   against; nil for a registry with no such root
       def initialize(root: nil)
         @root         = root
-        # Recorded at hecksagon-build time (AggregateDoor#mark_sensitive), Loader.boot's
+        # Recorded at hecksagon-build time (AggregateModule#mark_sensitive), Loader.boot's
         # post-dispatch step turns each pending privacy marking into a real Privacy::Marking.Mark,
         # idempotently. `resolved_eras` and `superseded_eras` are eager, not lazy, so no two
         # dispatching threads race to create them; all writes still happen at boot,

data/lib/hecks/runtime/saga_interpreter/compensation.rb

@@ -7,7 +7,7 @@ module Hecks
       module Compensation
         private
 
-        # Recorded before dispatching, not after `@door.reenter` returns —
+        # Recorded before dispatching, not after `@dispatcher.reenter` returns —
         # reenter can recursively re-enter this interpreter and refuse
         # before ever returning here, and recording only on success would
         # be too late for that nested refusal to see this leg's own

data/lib/hecks/runtime/saga_interpreter/delivery.rb

@@ -24,7 +24,7 @@ module Hecks
           record = { process_manager: process_manager.name, instance: correlation, dispatch: spec.command_name }
 
           log_dispatch_inputs(leg, spec, args) unless spec.with_spec.to_a.empty?
-          return refuse_at_depth_ceiling(leg, record) if @door.reaction_depth_reached?
+          return refuse_at_depth_ceiling(leg, record) if @dispatcher.reaction_depth_reached?
 
           attempt_dispatch(leg, spec, args, record)
         end
@@ -46,7 +46,7 @@ module Hecks
         # it unwinds like a refusal rather than stranding the instance.
         def refuse_at_depth_ceiling(leg, record)
           @registry.saga_log << record.merge(delivered: false,
-                                             reason:    "reaction depth #{@door.max_reaction_depth} reached")
+                                             reason:    "reaction depth #{@dispatcher.max_reaction_depth} reached")
           unwind(leg)
         end
 
@@ -95,14 +95,14 @@ module Hecks
           nil
         end
 
-        # Dispatches `command_name` through the door, stamped with this saga's correlation.
+        # Dispatches `command_name` through the dispatcher, stamped with this saga's correlation.
         def reenter_command(leg, command_name, projected, explicit:, source_receiver:)
           head = leg.process_manager.correlation_head
           verb = qualified(command_name, leg.domain)
           invocation = ReactionInvocation.build(registry: @registry, verb: verb, projected: projected,
                                                 explicit: explicit, passthrough: [head],
                                                 source_receiver: source_receiver)
-          @door.reenter(verb, saga_correlation: { head.to_s => leg.correlation }, **invocation)
+          @dispatcher.reenter(verb, saga_correlation: { head.to_s => leg.correlation }, **invocation)
         end
 
         # Unlike a refusal, a crash isn't a domain decision, so it

data/lib/hecks/runtime/saga_interpreter/transitions.rb

@@ -21,7 +21,7 @@ module Hecks
 
         # The mutex covers only the check-mutate-checkpoint step, never the
         # dispatch cascade that follows — `deliver_saga_dispatch`'s
-        # `@door.reenter` can recursively re-enter this interpreter on the
+        # `@dispatcher.reenter` can recursively re-enter this interpreter on the
         # same thread, and `Mutex` is not reentrant.
         def remembered_leg_taken?(leg)
           leg.instance = @registry.saga_instances[leg.process_manager.name][leg.correlation]

data/lib/hecks/runtime/saga_interpreter.rb

@@ -55,11 +55,11 @@ module Hecks
 
       # @param registry [Runtime::Registry] the booted registry whose declared
       #   process managers and saga persistence this interpreter runs against
-      # @param door [Runtime::Dispatcher] the dispatcher a saga leg's own dispatch
+      # @param dispatcher [Runtime::Dispatcher] the dispatcher a saga leg's own dispatch
       #   re-enters through
-      def initialize(registry, door:)
+      def initialize(registry, dispatcher:)
         @registry = registry
-        @door     = door
+        @dispatcher = dispatcher
       end
 
       # Runs `domain`'s declared process managers against `event`: begins,

data/lib/hecks/runtime/tenant_check.rb

@@ -1,4 +1,5 @@
 require_relative "../ports/persistence/binding_policy"
+require_relative "best_effort"
 
 module Hecks
   module Runtime
@@ -37,10 +38,10 @@ module Hecks
       # Same defensive shape as EraCheck#lineage_capable? — a class that
       # doesn't respond at all, or whose lookup raises, is false, not an error.
       def tenant_capable?(registry, adapter_name)
-        adapter_class = registry.adapters[adapter_name] && registry.adapter_class(adapter_name)
-        adapter_class.respond_to?(:tenant_capable?) && adapter_class.tenant_capable?
-      rescue StandardError
-        false
+        BestEffort.call(false) do
+          adapter_class = registry.adapters[adapter_name] && registry.adapter_class(adapter_name)
+          adapter_class.respond_to?(:tenant_capable?) && adapter_class.tenant_capable?
+        end
       end
     end
   end

data/lib/hecks/runtime/value/coercion.rb

@@ -37,9 +37,9 @@ module Hecks
         # Coerces `value` for a single, already-resolved `attribute`, branching on
         # its declared shape (list, reference, composite, or bare scalar).
         #
-        # `boundary: false` is the query door, where a declared type documents the
+        # `boundary: false` is the query entry point, where a declared type documents the
         # argument for callers/generators rather than naming a shape to enforce.
-        # `argument: true` is the command/entity/port dispatch door, where a nil for
+        # `argument: true` is the command/entity/port dispatch entry point, where a nil for
         # a required attribute is a left-empty argument (C3.7), not ordinary state nil.
         #
         # @raise [Runtime::TypeMismatch] if `value` cannot be coerced, or a required

data/lib/hecks/runtime/value/validation.rb

@@ -34,7 +34,11 @@ module Hecks
           fields
         end
 
-        # Fills every declared attribute `fields` lacks with its own `default:`.
+        # Fills every declared attribute `fields` lacks with its own `default:`, and every required
+        # list it lacks with an empty one: a list left out reads as no members, the one shape the
+        # Rust runtime (a `Vec`) can hold, so a value object built from nothing (a required
+        # argument left empty, C3.7) is `{blocks: []}` on both sides rather than `{}` here.
+        # An optional list stays absent, and an offered list, empty or not, is kept as offered.
         #
         # @param value_object [Class] the `Bluebook::ValueObject` subclass whose
         #   declared defaults are read
@@ -42,11 +46,11 @@ module Hecks
         # @return [Hash{Symbol => Object}] `fields`, with defaults filled in
         def apply_defaults(value_object, fields)
           value_object.attributes.each_with_object(fields) do |attribute, completed|
-            completed[attribute.name] = attribute.default unless completed.key?(attribute.name) || attribute.default.nil?
+            fill_absent(completed, attribute) unless completed.key?(attribute.name)
           end
         end
 
-        # The full door a value object's own fields pass through — shared by
+        # The full entry point a value object's own fields pass through — shared by
         # `build` and `normalize_composite_fields`, so a nested field refuses
         # exactly like the same type declared directly on a command.
         #
@@ -85,6 +89,13 @@ module Hecks
 
         private
 
+        # The default an absent attribute declares, else an empty list for a required list.
+        def fill_absent(fields, attribute)
+          return fields[attribute.name] = attribute.default unless attribute.default.nil?
+
+          fields[attribute.name] = [] if attribute.list? && !attribute.optional?
+        end
+
         def normalize_composite_field(aggregate, attribute, fields)
           # A list member hydrates the same as a top-level list, so a value
           # read back from the store matches the shape a live dispatch wrote.
@@ -109,7 +120,8 @@ module Hecks
           validate_input_list(aggregate, attribute, fields)
         end
 
-        # Runs each value-object member of an input list through the same door a nested single
+        # Runs each value-object member of an input list through the same entry point a nested
+        # single
         # value goes through, so a member's own invariants and nested lists refuse on dispatch
         # exactly as they do when the list sits directly on a command. The members stay as offered.
         def validate_input_list(aggregate, attribute, fields)

data/lib/hecks/runtime.rb

@@ -42,12 +42,12 @@ module Hecks
       #
       # @param path [String] path to a domain directory, or a file inside one
       # @param shared [String, nil] a shared-root override
-      # @param install_doors [Boolean] whether to install the Ruby facade constants
+      # @param install_driving [Boolean] whether to install the Ruby facade constants
       # @param environment [String, nil] the environment name for `Adapters::Folder#load_domain`
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the dispatcher bound
       #   to the booted domain
-      def boot(path, shared: nil, install_doors: true, environment: Runtime::Loader::FROM_ENV)
-        Loader.boot(path, shared: shared, install_doors: install_doors, environment: environment)
+      def boot(path, shared: nil, install_driving: true, environment: Runtime::Loader::FROM_ENV)
+        Loader.boot(path, shared: shared, install_driving: install_driving, environment: environment)
       end
 
       # Loads a domain's declarations without binding any adapter. See Loader.describe.
@@ -63,23 +63,23 @@ module Hecks
       # Finishes a boot from declarations `describe` already loaded. See Loader.boot_described.
       #
       # @param described [Runtime::Loader::Described] what `describe` answered
-      # @param install_doors [Boolean] whether to install the Ruby facade constants
+      # @param install_driving [Boolean] whether to install the Ruby facade constants
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the dispatcher bound
       #   to the booted domain
-      def boot_described(described, install_doors: true)
-        Loader.boot_described(described, install_doors: install_doors)
+      def boot_described(described, install_driving: true)
+        Loader.boot_described(described, install_driving: install_driving)
       end
 
       # Loads only the given files of a domain; otherwise like `boot`. See Loader.boot_files.
       #
       # @param paths [String, Array<String>] one or more file paths within the domain
       # @param shared [String, nil] a shared-root override
-      # @param install_doors [Boolean] whether to install the Ruby facade constants
+      # @param install_driving [Boolean] whether to install the Ruby facade constants
       # @param environment [String, nil] the environment name for the selected-file loader
       # @return [Runtime::Dispatcher, Runtime::RemoteDispatcher] the dispatcher bound
       #   to the booted domain
-      def boot_files(paths, shared: nil, install_doors: true, environment: Runtime::Loader::FROM_ENV)
-        Loader.boot_files(paths, shared: shared, install_doors: install_doors, environment: environment)
+      def boot_files(paths, shared: nil, install_driving: true, environment: Runtime::Loader::FROM_ENV)
+        Loader.boot_files(paths, shared: shared, install_driving: install_driving, environment: environment)
       end
 
       # Bind the ambient registry for the duration of the block, restoring

data/lib/hecks/rust_build/host.rb

@@ -4,6 +4,7 @@ require "fileutils"
 require "open3"
 require_relative "../rust_build"
 require_relative "wasm"
+require_relative "prebuilt_binary"
 
 module Hecks
   module RustBuild
@@ -102,13 +103,19 @@ module Hecks
       def compile(target)
         host_dir = File.join(RustBuild.rust_dir, "host")
         target_dir = ENV.fetch("CARGO_TARGET_DIR", File.join(host_dir, "target"))
+        binary = File.join(target_dir, target, "release", BINARY)
+        return binary if PrebuiltBinary.fetch("host", host_dir, target: target, into: binary)
+
+        cargo_build(target, host_dir, { "CARGO_TARGET_DIR" => target_dir }.merge(linker_for(target)))
+        binary
+      rescue Failure => e
+        raise Failure, "#{e.message}#{cross_hint(target)}"
+      end
+
+      def cargo_build(target, host_dir, env)
         puts "== cargo build --release --target #{target} --bin #{BINARY} (rust/host) =="
-        env = { "CARGO_TARGET_DIR" => target_dir }.merge(linker_for(target))
         RustBuild.command!("rustup", "run", TOOLCHAIN, "cargo", "build", "--release", "--target", target,
                            "--bin", BINARY, chdir: host_dir, env: env)
-        File.join(target_dir, target, "release", BINARY)
-      rescue Failure => e
-        raise Failure, "#{e.message}#{cross_hint(target)}"
       end
 
       def linker_for(target)

data/lib/hecks/rust_build/prebuilt_binary.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "net/http"
+require "uri"
+require "hecks/vocabulary"
+
+module Hecks
+  module RustBuild
+    # A binary hecks has already compiled and published, named by what went into it (ADR 0110).
+    #
+    # The `PrebuiltBinary` rows of the Vocabulary chapter say which binaries are published: the
+    # crate to key, the Cargo binary, the target it is built for. A release tagged `<name>-<key>`
+    # holds the binary and its `.sha256`; the key is a hash of the crate's build inputs, so the
+    # same bytes are the same release, whichever commit they come from. `fetch` downloads it and
+    # checks its hash, and answers nil on any miss (not published yet, no network, a hash that
+    # does not match) so a caller compiles as it always did. `HECKS_PREBUILT=off` turns the
+    # download off.
+    module PrebuiltBinary
+      # Where releases are published.
+      REPOSITORY = "heckslabs/hecks"
+
+      # Left out of the key: Cargo's own output, and files that are never part of the binary.
+      EXCLUDED = %w[target tests .gitignore].freeze
+
+      MAX_REDIRECTS = 5
+
+      module_function
+
+      # @param name [String] a `PrebuiltBinary` row's name
+      # @return [Hash{String => String}] the row
+      # @raise [KeyError] when no row has the name
+      def row(name)
+        Hecks::Vocabulary.rows("PrebuiltBinary").find { |found| found["name"] == name } or
+          raise KeyError, "no PrebuiltBinary row named #{name.inspect}"
+      end
+
+      # @param crate_dir [String] the crate's directory
+      # @return [String] a hash of every file that goes into the build: each path and its bytes, in
+      #   path order, so it does not depend on the checkout it is read from
+      def key(crate_dir)
+        files = Dir.glob("**/*", File::FNM_DOTMATCH, base: crate_dir).sort.select do |path|
+          File.file?(File.join(crate_dir, path)) && !EXCLUDED.include?(path.split("/").first)
+        end
+        digest = Digest::SHA256.new
+        files.each { |path| digest << "#{path}\0#{File.binread(File.join(crate_dir, path))}\0" }
+        digest.hexdigest[0, 24]
+      end
+
+      # @param name [String] a row's name
+      # @param key [String] the crate's key
+      # @return [String] the release tag
+      def tag(name, key) = "#{name}-#{key}"
+
+      # @param name [String] a row's name
+      # @return [String] the file the release holds the binary as
+      def asset(name)
+        found = row(name)
+        "#{found["executable"]}-#{found["target"]}"
+      end
+
+      # @param name [String] a row's name
+      # @param crate_dir [String] the crate's directory
+      # @param target [String] the triple the caller builds for
+      # @param into [String] the file to write the binary to
+      # @return [String, nil] `into`, or nil when the binary is not published for this target or
+      #   could not be fetched and verified
+      def fetch(name, crate_dir, target:, into:)
+        return if ENV["HECKS_PREBUILT"] == "off" || row(name)["target"] != target
+
+        body = verified(name, crate_dir) or return
+        FileUtils.mkdir_p(File.dirname(into))
+        File.binwrite(into, body)
+        File.chmod(0o755, into)
+        puts "== downloaded the prebuilt #{asset(name)} (#{tag(name, key(crate_dir))}); nothing compiled =="
+        into
+      rescue SystemCallError, SocketError, Timeout::Error, OpenSSL::SSL::SSLError
+        nil
+      end
+
+      # @return [String, nil] the published binary, nil unless its bytes hash to the published
+      #   sha256
+      def verified(name, crate_dir)
+        base = "https://github.com/#{REPOSITORY}/releases/download/#{tag(name, key(crate_dir))}/#{asset(name)}"
+        expected = get("#{base}.sha256")&.split&.first
+        body = expected && get(base)
+        body if body && Digest::SHA256.hexdigest(body) == expected
+      end
+
+      # @return [String, nil] the body at the URL, following redirects, nil unless it answers 200
+      def get(url, redirects = MAX_REDIRECTS)
+        response = Net::HTTP.get_response(URI(url))
+        return response.body if response.is_a?(Net::HTTPSuccess)
+        return get(response["location"], redirects - 1) if response.is_a?(Net::HTTPRedirection) && redirects.positive?
+
+        nil
+      end
+    end
+  end
+end

data/lib/hecks/rust_build/project_rust/target_ir.rb

@@ -11,7 +11,7 @@ module Hecks
         # The optional attachments `rust/host` reads from `ir.json`, each omitted when nothing
         # attached provides it: exporter method, then the key it is written under.
         SEAMS = %i[authorization membership identity newsletter newsletter_issues payments
-                   registrations payment_connection].freeze
+                   registrations payment_connection checkout].freeze
 
         # Round-trips a value through JSON so generators see the string-keyed shape a real
         # `ir.json` carries, never live Ruby symbols.

data/lib/hecks/rust_build/wasm.rb

@@ -60,7 +60,7 @@ module Hecks
       end
 
       def require_target!
-        return if system("rustup target list --installed 2>/dev/null | grep -qx #{TARGET}")
+        return if RustBuild.target_installed?(TARGET)
 
         raise Failure, <<~MSG
           #{TARGET} isn't installed for this toolchain. Install it once with:

data/lib/hecks/rust_build/wasm_browser.rb

@@ -52,7 +52,7 @@ module Hecks
       end
 
       def require_target!
-        return if system("rustup target list --installed 2>/dev/null | grep -qx #{TARGET}")
+        return if RustBuild.target_installed?(TARGET)
 
         raise Failure, <<~MSG
           #{TARGET} isn't installed for this toolchain. Install it once with: